Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vitejs/launch-editor

              main @ 3f97c64
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

packages/launch-editor/index.js: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Insecure handling of the file argument when spawning editor processes on Windows allows attackers to inject shell metacharacters and execute arbitrary commands via cmd.exe. This risk was addressed across multiple iterations, moving from fragile regex allowlists to proper escaping/quoting when invoking system commands.

Information Disclosure: Passing arbitrary Windows UNC paths to filesystem checks (such as checking if a file exists) triggers automatic SMB connections, leaking the user's NTLMv2 password hashes to remote, attacker-controlled servers.